The UiPress lite plugin for WordPress contains a code injection vulnerability (CWE-94) in the uip_process_form_input() function. This function executes user-supplied inputs as code without verifying user capabilities, enabling authenticated attackers with low privileges (Subscriber-level and above) to perform remote code execution on the server. The vulnerability affects all versions up to and including 3.5.07. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to execute arbitrary code on the server hosting the WordPress site. This can lead to full system compromise, including unauthorized data access, modification, or deletion, and disruption of service. The vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and consider disabling or removing the UiPress lite plugin if possible. Monitor for updates from the vendor or security advisories to apply an official patch promptly once available.